StyleSmuggler in Magento Commerce: Sansec Adds Backdoor Details, Adobe Patch Still Missing

StyleSmuggler is, according to Sansec, an actively exploited unauthenticated vulnerability enabling remote code execution in Magento Open Source and Adobe Commerce. Researchers have added a technical analysis of the attack, including information about a persistent backdoor and additional indicators of compromise. As of September 6, 2026, Adobe has not published a bulletin or patch for this vulnerability.

According to Sansec, the exploit inserts PHP code into the template system through the styles parameter. It is reportedly executed when an email about a failed payment is rendered. According to the analysis, nobody necessarily needs to open the email.

How StyleSmuggler Works in Magento Commerce

A key characteristic of the reported attack is that it does not require authentication. If the chain described by Sansec is confirmed in a particular environment, an attacker could insert code into templates and activate it by processing a system email about an unsuccessful payment.

Sansec says that after a successful intrusion, a persistent backdoor process disguised as [kworker/u:8:0] is launched on the server. The company has also published additional network indicators of compromise and a second hash, which operators can use during forensic checks of their systems.

Claims about the exploit mechanism, the backdoor, and its operation currently come from Sansec. Adobe has not publicly confirmed them. The scope of the campaign, the number of potentially compromised stores, and the attackers’ identities are also not independently known.

Sansec Has Not Yet Detected Further Use of the Backdoor

Researchers said they have not so far recorded use of the described backdoor for additional malicious operations. This does not mean the process should not be investigated: according to the published analysis, its presence is a relevant artifact of compromise.

Sansec released eComscan 1.9.7. For Shield customers, the tool is designed to terminate processes masked with the stated name. For other operators, the hash and network indicators published in the analysis, which Sansec linked to the incident, are particularly important.

Adobe Patch Still Not Listed

Adobe’s official security bulletin overview was updated on September 3 as of September 6 and does not include a bulletin or patch for StyleSmuggler. Adobe’s next scheduled security bulletin is due on September 8.

It has not been confirmed whether that release will include a CVE, a security patch, or another measure for Magento Open Source and Adobe Commerce. Operators therefore do not yet have a vendor-issued patch they can deploy against the reported vulnerability.

For administrators of affected online stores, two things are currently important: check their own servers against Sansec’s new indicators and monitor Adobe’s next bulletin. Further developments could also bring a more complete analysis of the gadget chain, dropper, and implant, or independent information about the scope of the attacks.

Verified and updated: 09/06/2026 15:20